ZeroDay Findings
Sign inSign up

Findings

CVE-2025-27850

The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack.

Published May 13, 2026 · updated Jun 17, 2026 · garmin empirbus wireless display unit firmware

The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. If a malicious graphics package containing symlinks is uploaded, the web server follows the supplied links when serving content. No mechanisms to restrict those link targets to a specific area of the filesystem is enabled. This allows an attacker to retrieve arbitrary files from the device.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 13, 2026 · NIST NVD

    Detected

    The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. If a malicious graphics package containing symlinks is uploaded, the web server follows the supplied links when serving content. No mechanisms to restrict those link targets to a specific area of the filesystem is enabled. This allows an attacker to retrieve arbitrary files from the device.

  2. Jun 17, 2026 · NIST NVD

    Updated

    The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. If a malicious graphics package containing symlinks is uploaded, the web server follows the supplied links when serving content. No mechanisms to restrict those link targets to a specific area of the filesystem is enabled. This allows an attacker to retrieve arbitrary files from the device.

Affected

  • cpe garmin/empirbus wireless display unit firmware1.4.6
  • cpe garmin/empirbus wireless display unit firmware5.00

Sources

  • CVE.orgVulnerability recordCVE-2025-27850

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2025-27850

    The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. If a malicious graphics package containing symlinks is uploaded, the web server follows the supplied links when serving content. No mechanisms to restrict those link targets to a specific

    nvd.nist.gov

References